Add secret to constructor
Create token from secret if secret is available, else from serialized $_SERVER
Unset token after it has been used
Move token creation after validation check

When the token has been used and thus unset, it needs to be created
again in case we want to use it in a form.
Check if key exists in session before retrieving it